A few days ago InQuest discovered a very interesting sample that was uploaded from Iran. The document is a contract for the supply of services to an energy company from southern Iran “Tavangoostar Niro va Gashtavar Jonob”. The document also contains a link to this energy company. Since this family of malicious documents containing executable files was not previously known, InQuest named it the Green Stone.

Reference: https://inquest.net/blog/2022/07/27/green-stone